ComboFix 07-10-17.8 - ^Mateusz^ 2007-10-17 22:37:29.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.605 [GMT 2:00]
Running from: C:\Documents and Settings\^Mateusz^\Pulpit\—ci¥gni©te\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\dat.txt
C:\WINDOWS\optnet.dll
C:\WINDOWS\rs.txt
.
((((((((((((((((((((((((( Files Created from 2007-09-17 to 2007-10-17 )))))))))))))))))))))))))))))))
.
2007-10-17 22:36 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-17 21:44 1,506 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-17 21:43 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-17 21:43 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-17 21:43 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-17 21:43 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-17 21:43 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-17 19:35
d-------- C:\Program Files\Trojan Remover
2007-10-17 19:35 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Simply Super Software
2007-10-17 19:35 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2007-10-17 19:35 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-10-17 19:35 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2007-10-17 19:35 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-10-17 19:35 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2007-10-17 19:23 d-------- C:\Program Files\SkanerOnline
2007-10-17 19:11 d-------- C:\Program Files\Panda Security
2007-10-17 15:18 d-------- C:\Program Files\ygwowslc
2007-10-17 15:18 126,976 --a------ C:\Documents and Settings\All Users\Dane aplikacji\zyfslars.dll
2007-10-17 15:11 270,336 --a------ C:\WINDOWS\ntspknlg.dll
2007-10-17 15:11 257,536 --a------ C:\WINDOWS\hostctrl.dll
2007-10-17 15:11 33,280 --a------ C:\WINDOWS\nmcuninstall.exe
2007-10-15 16:40 d--hs---- C:\found.006
2007-10-11 18:06 d-------- C:\Documents and Settings\Mama\Dane aplikacji\Super-Cow
2007-10-11 18:05 d-------- C:\Program Files\Supercow
2007-10-10 05:43 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-10 05:38 d--hs---- C:\found.005
2007-10-04 18:31 327,168 --a------ C:\WINDOWS\IsUn0415.exe
2007-10-04 18:31 228,352 -ra------ C:\WINDOWS\system32\DECO_32.DLL
2007-10-04 18:31 17,920 --a------ C:\WINDOWS\system32\IMPLODE.DLL
2007-10-04 18:25 d-------- C:\Program Files\Common Files\Borland Shared
2007-10-04 18:25 210,032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL
2007-10-03 20:20 d-------- C:\Program Files\Common Files\PocketSoft
2007-10-03 20:20 197,120 --a------ C:\WINDOWS\patchw32.dll
2007-10-01 18:18 d-------- C:\Program Files\Magic Tea
2007-10-01 18:04 d-------- C:\Documents and Settings\All Users\Dane aplikacji\FireGlow
2007-10-01 16:20 d--hs---- C:\WINDOWS\ftpcache
2007-09-27 00:45 d-------- C:\Program Files\Chicken Invaders 2
2007-09-24 18:50 d-------- C:\Program Files\SuperAudiotool
2007-09-24 18:50 d-------- C:\My Music
2007-09-24 18:50 3,082 --a------ C:\WINDOWS\system32\affv11300p4now.sys
2007-09-24 18:50 5 --a------ C:\WINDOWS\system32\SySVid.dat
2007-09-24 16:58 4,096 --a------ C:\WINDOWS\d3dx.dat
2007-09-23 17:05 d-------- C:\Program Files\Hero Editor
2007-09-23 17:05 249,856 --------- C:\WINDOWS\Setup1.exe
2007-09-23 17:05 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-09-23 08:53 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-23 07:23 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-09-23 07:23 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-09-23 07:23 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-09-23 07:14 106,496 --a------ C:\WINDOWS\DIIUnin.exe
2007-09-23 07:14 29,564 --a------ C:\WINDOWS\DIIUnin.dat
2007-09-23 07:14 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-09-21 15:30 d-------- C:\Program Files\Microsoft.NET
2007-09-21 15:29 d-------- C:\Program Files\Microsoft Visual Studio 8
2007-09-21 15:29 d-------- C:\Program Files\Common Files\Merge Modules
2007-09-21 06:20 d-------- C:\Program Files\Microsoft SQL Server
2007-09-17 14:04 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-09-17 14:04 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-09-17 14:04 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-09-17 14:04 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2007-09-17 09:54 d-------- C:\Documents and Settings\Mama\Dane aplikacji\ForgottenRiddles
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-17 20:39 4,718,592 ---ha-w C:\Documents and Settings\^Mateusz^\NTUSER.DAT
2007-10-17 19:01 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-10-17 17:35 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Simply Super Software
2007-10-17 13:25 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-17 13:24 --------- d-----w C:\Program Files\Codec Pack - All In 1
2007-10-14 10:55 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Skype
2007-10-10 16:26 --------- d-s---w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Microsoft
2007-10-10 12:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-03 13:31 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Atari
2007-10-03 13:25 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Leadertech
2007-10-03 12:17 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\uTorrent
2007-09-23 16:56 19,024 ----a-w C:\Documents and Settings\^Mateusz^\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-09-21 13:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-09-20 18:02 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\fretsonfire
2007-09-17 13:05 --------- d-----w C:\Program Files\Wise Registry Cleaner
2007-09-15 21:45 --------- d-----w C:\Program Files\Lavasoft
2007-09-15 21:43 --------- d-----w C:\Program Files\RegCleaner
2007-09-15 21:36 --------- d-----w C:\Program Files\CodeStuff
2007-09-15 21:34 --------- d-----w C:\Program Files\Paper Chase 2
2007-09-15 21:25 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\iolo
2007-09-15 21:25 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\iolo
2007-09-15 21:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2007-09-15 08:43 --------- d-----w C:\Program Files\AtomixMP3
2007-09-15 08:39 --------- d-----w C:\Program Files\Carrot
2007-09-14 10:24 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\BearShare
2007-09-13 17:34 --------- d-----w C:\Program Files\Mp3 Knife
2007-09-13 17:20 --------- d-----w C:\Program Files\FREE Hi-Q Recorder
2007-09-13 17:16 --------- d-----w C:\Program Files\Sony Ericsson
2007-09-13 17:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2007-09-13 17:15 --------- d-----w C:\Program Files\Intuwave Ltd
2007-09-11 14:38 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\Darwin
2007-09-11 14:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FreshGames
2007-09-10 18:27 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Hewlett-Packard
2007-09-10 18:26 --------- d-----w C:\Program Files\Hewlett-Packard
2007-09-10 18:25 82,380 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-09-10 18:17 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-09-05 19:06 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\IGN_DLM
2007-09-02 18:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ScreenSeven
2007-08-31 18:30 --------- d-----w C:\Program Files\Skype
2007-08-31 18:30 --------- d-----w C:\Program Files\Common Files\Skype
2007-08-31 18:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-08-29 14:15 271,360 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2007-08-29 14:15 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2007-08-29 13:25 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-08-28 15:45 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-08-28 08:18 --------- d-----w C:\Program Files\ATI Technologies
2007-08-26 20:30 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\gtopala
2007-08-26 09:28 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\Corel
2007-08-25 13:24 --------- d-----w C:\Program Files\Vimicro
2007-08-25 09:42 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Help
2007-08-24 13:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sandlot Games
2007-08-23 16:05 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\mbin.jp
2007-08-22 17:17 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Subversion
2007-08-20 17:51 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\DiVision Studios XAvenger
2007-08-20 14:25 --------- d-----w C:\Program Files\MSXML 4.0
2007-08-19 08:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2007-08-19 08:53 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-08-19 08:53 --------- d-----w C:\Documents and Settings\^Mateusz^\Dane aplikacji\Corel
2007-08-18 15:32 --------- d-----w C:\Program Files\Common Files\DirectX
2007-07-20 17:23 737,280 ----a-w C:\WINDOWS\iun6002.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="E:\Programy\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2007-09-30 19:38]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:44]
"Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-07-09 09:39]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hostctrl"= {3147D8FA-0627-4635-9A0E-75F64A39E8DA} - C:\WINDOWS\hostctrl.dll [2007-10-17 11:57 257536]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
E:\Programy\Winamp\winampa.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-10-10 18:27:03 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1189448782.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-17 22:41:06
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-17 22:42:55 - machine was rebooted
.
--- E O F ---